EP1569413B1 - Méthode et dispositif de filtrage des communications pour prévenir l'exploitation de vulnérabilités logicielles - Google Patents

Méthode et dispositif de filtrage des communications pour prévenir l'exploitation de vulnérabilités logicielles Download PDF

Info

Publication number
EP1569413B1
EP1569413B1 EP05101123.7A EP05101123A EP1569413B1 EP 1569413 B1 EP1569413 B1 EP 1569413B1 EP 05101123 A EP05101123 A EP 05101123A EP 1569413 B1 EP1569413 B1 EP 1569413B1
Authority
EP
European Patent Office
Prior art keywords
message
application
vulnerability
communication
received
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP05101123.7A
Other languages
German (de)
English (en)
Other versions
EP1569413A2 (fr
EP1569413A3 (fr
Inventor
Alf Zugenmaier
Chuanxiong c/o Microsoft Corporation Guo
Daniel R. Simon
Jason Garms
Jiahe Helen c/o Microsoft Corporation Wang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Microsoft Technology Licensing LLC
Original Assignee
Microsoft Technology Licensing LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Microsoft Technology Licensing LLC filed Critical Microsoft Technology Licensing LLC
Priority to EP19175041.3A priority Critical patent/EP3544259A1/fr
Publication of EP1569413A2 publication Critical patent/EP1569413A2/fr
Publication of EP1569413A3 publication Critical patent/EP1569413A3/fr
Application granted granted Critical
Publication of EP1569413B1 publication Critical patent/EP1569413B1/fr
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • A—HUMAN NECESSITIES
    • A46—BRUSHWARE
    • A46B—BRUSHES
    • A46B11/00—Brushes with reservoir or other means for applying substances, e.g. paints, pastes, water
    • A46B11/001—Brushes with reservoir or other means for applying substances, e.g. paints, pastes, water with integral reservoirs
    • A46B11/002—Brushes with reservoir or other means for applying substances, e.g. paints, pastes, water with integral reservoirs pressurised at moment of use manually or by powered means
    • A46B11/0041—Flexible or deformable reservoirs, e.g. resilient bulbs, compressible tubes
    • A—HUMAN NECESSITIES
    • A46—BRUSHWARE
    • A46B—BRUSHES
    • A46B17/00—Accessories for brushes
    • A46B17/04—Protective covers for the bristles
    • A—HUMAN NECESSITIES
    • A46—BRUSHWARE
    • A46B—BRUSHES
    • A46B5/00—Brush bodies; Handles integral with brushware
    • A46B5/0095—Removable or interchangeable brush heads
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • A—HUMAN NECESSITIES
    • A46—BRUSHWARE
    • A46B—BRUSHES
    • A46B2200/00—Brushes characterized by their functions, uses or applications
    • A46B2200/10—For human or animal care
    • A46B2200/1066—Toothbrush for cleaning the teeth or dentures

Definitions

  • the described technology relates generally to detecting and preventing an exploitation of a vulnerability of an application.
  • a worm is a self-propagating attack that exploits a vulnerability by taking control of the computer system and using that computer system to launch attacks (i.e., send the same worm) against other computer systems with the same vulnerability.
  • a worm is a message or sequence of messages designed to exploit a vulnerability of the receiving computer program. Upon receiving the message or messages, the computer program performs some action that allows the worm to take control of the computer system.
  • the developer typically develops and distributes to system administrators "patches" that remove the vulnerability. If the vulnerability has not yet been exploited (e.g., might not be known to hackers), then a developer can design, implement, test, and distribute a patch in a disciplined way. If the vulnerability has already been widely exposed, then the developer may rush to distribute a patch without the same care that is used under normal circumstances. When patches are distributed to the administrators of the computer systems, they are responsible for scheduling and installing the patches to remove the vulnerabilities.
  • US 2002/0124187 A1 describes a system and method for analyzing protocol streams for a security-related event.
  • a method and system for identifying when a condition of a communication protocol of a component is to be satisfied is provided.
  • the system provides a specification that specifies at least a portion of the communication protocol (i.e., a model of the communication protocol) and indicates within the specified portion of the communication protocol when the condition is satisfied.
  • the system determines, before the processing of the communication by the component, whether the received communication would satisfy the condition as specified by the provided specification. The system can then take appropriate action depending on whether the condition is satisfied. For example, if the condition relates to the exposing of a vulnerability of the component, then the system may take the action of not providing the communication to the component when the condition is satisfied to prevent the exposing of the vulnerability.
  • a method and system for protecting a component, such as an application, that implements a communication protocol (e.g., message-based or stream-based protocol) against exploitation of a communication-based vulnerability is provided.
  • a protection system provides a "protection policy" that specifies how to recognize messages that expose a specific vulnerability and specifies actions to take when the vulnerability is exposed.
  • a protection policy specifies the sequence of messages and their payload characteristics that expose a vulnerability.
  • the protection system may specify the sequences of messages using a message protocol state machine.
  • a message protocol state machine of an application represents the states that the application transitions through as it receives various messages.
  • the message protocol state machine of a protection policy may be a portion of the message protocol state machine of the application relating to the vulnerability.
  • the protection system uses the message protocol state machine to track the states that lead up to exposing the vulnerability.
  • the protection policy may specify actions to be performed depending on the current state and the received or current message. These actions may include checking the payloads of the messages to determine whether certain conditions are met, identifying a next state for the message protocol state machine, discarding a message, disconnecting from the source of a message, and so on. Because the protection policy is based on the message protocol associated with the vulnerability, it is independent of any exploitation of the vulnerability. The protection system thus models the communication-based protocol that is used by the application so that conditions such as the exposing of vulnerabilities can be detected and prevented.
  • a protection policy describes a vulnerability of an application and actions to protect against exploitation of the vulnerability.
  • a protection policy has two parts. The first part defines protocol states, events, and generic application-level protocol information, such as ports used, locations of event types, session identifiers, and sequence numbers in a packet, and message boundary markers. The second part defines handlers (i.e., sets of actions) and message payload parsing instructions. The handlers are executed at runtime to examine a message payload and identify any exploitation of the vulnerability, and to take countermeasures to prevent its exploitation or to record session information that is needed for a later identification of an exploitation.
  • the protection system parses the handlers and the payload instructions of a protection policy and stores them in a syntax tree for more efficient processing at runtime.
  • the protection system stores the first part of the protection policy and the syntax tree as a "vulnerability specification.”
  • the vulnerability specification may include triplets of state, event, and handlers.
  • the protection system When the protection system receives a message before it has been sent to the application, it identifies the event corresponding to the message and the current state of the message protocol state machine of the application. The protection system then identifies and executes the handler associated with the current state and the current event as indicated by the triplets. The handler may analyze the message, including its payload, to determine whether characteristics leading to the exposing of the vulnerability are present, may change the current state to a next state that depends on the characteristics of the message, may save state information needed to make subsequent determinations when other messages are received, may perform counteractions against identified exploitations, and so on. If the protection system determines that a message would expose the vulnerability, it does not provide the message to the application. The protection system thus prevents the exploitation of a vulnerability of an application without patching the application. Moreover, the protection system provides a generic framework that can be used to prevent exploitation of vulnerabilities for many different message-based applications.
  • the protection system operates between the transport layer and the application layer of the network protocol.
  • the protection system can operate in between or within various network protocol layers and multiple protocol layers simultaneously.
  • some applications may provide hooks for pre-processing messages before the application performs its processing.
  • the protection system can operate at the application layer and process the messages before the application processes the message. If the protection system determines that a vulnerability is exposed, then it can discard the message, abort the application, or take some other appropriate action.
  • Applications that service multiple clients may assign a session identifier to each client for use in identifying which client sent a message.
  • a single client may have multiple sessions and thus multiple session identifiers.
  • a session identifier identifies a particular session of a client.
  • a sequence of messages within a session can expose a vulnerability.
  • the protection system tracks the state of messages on a session-by-session basis. The protection system creates a new instance of state information when a new session is identified. Each message identifies the target application and session. When a message is received, the protection system identifies the application and the session from the message.
  • the protection system may identify the application based on a port number stored in header information of the message and the session based on an application-specific indication of where session information is stored within the message.
  • the vulnerability specification of an application may specify the port numbers associated with that application and describe the location of a session identifier within the messages of that application.
  • the vulnerability specification of an application may specify the location of other information within a message such as the location of message type and the location of a message boundary. If the message is the first of a session, then the protection system may allocate a state information data structure for that session.
  • the vulnerability specification of an application may define the data structure based on the information that needs to be stored from message to message.
  • the protection system initializes the state information, which may include setting the current state for the session to an initial state defined by the vulnerability specification. Whenever a new message is received, the protection system identifies the application and session, retrieves the state information for that application and session, and then invokes a state machine engine to select a handler to execute based on the current state and an event specified by the received message.
  • the protection system handles application-level messages that may not arrive as a single message unit.
  • the scattered arrival of a single application-level message as multiple message units may be a result of TCP congestion control, specific message handling implementations of an application, and so on.
  • a UDP server may make multiple calls to receive a single application-level message.
  • the protection system recognizes the arrival of multiple message units for the application-level message.
  • the session identifier or the message type is not received in a single message unit or not enough of the application-level message has been received for a handler to finish its processing, the protection system makes a copy of the needed portions of each message unit until the application-level message can be processed by a handler.
  • the protection system could store the partial message information on a session-by-session basis, which might require the allocation of a buffer for each session.
  • the protection system may be able to store the partial message information on a socket-by-socket basis.
  • Sockets typically have the characteristic that a complete message for a session will be received before any portion of a different message is received via that same socket. Because there may be fewer sockets than sessions, fewer buffers may need to be allocated when storing the information on a session-by-session basis.
  • a buffer can be associated with only a socket before the session identifier is received. Once the session identifier is received, the buffer can be associated with the session.
  • the protection system does not need to save partially arrived fields, nor does it need to save the entire portion of the application-level message that has been received. For example, if two bytes out of a four-byte session identifier have been received, then the protection system need only save those two bytes of the message.
  • the protection system may use a field parsing state per application-level message to track which field is being parsed and how many bytes have been received. The protection system maintains the parsing state of the current field being parsed for each application-level message, even when it has been determined that the message will not lead to an exploitation. If the state was not maintained, then other parts of the application-level message might be treated as a new message. In such a case, a message might be crafted by an attacker to cause an inconsistency between the actual message state of the application and the emulated message state of the protection system.
  • the protection system may buffer application-level messages that are received out of order so that they can be processed in order. For example, when UDP is used, application-level messages can be received out of order.
  • the protection system uses the sequence number as specified in a protection policy for the application.
  • some application message protocols allow for fragmentation and reassembly of application-level messages.
  • the fragments can be received in order (e.g., with TCP) or out of order (e.g., with UDP).
  • the protection system can handle the fragments received in order in a manner similar to the partial-field processing described above. If the fragments are received out of order, the protection system can save them and process them in order.
  • the principles of the protection system can be applied to augment a message protocol. For example, it might be desirable to improve the security of an application by adding authentication processing at some state of the message protocol. The developer of the application may be, however, reluctant to do so.
  • a system e.g., an authentication system similar to the protection system could be implemented.
  • the authentication system may have a server side and a client side.
  • the server side would use a specification of states, events, and handlers and a state machine engine to identify the appropriate state and event when authentication should occur.
  • the handler for that state and event could send a challenge to a client before providing the message to the application.
  • the client side of the authentication system could detect that a challenge has been received and send the appropriate response.
  • the client side may have specifications and a state machine engine for detecting the challenge.
  • the server side receives the response, it can validate the response and provide the message to the application as appropriate.
  • a generic architecture is provided that can track message protocol states and perform the desired processing prior to processing by the target application.
  • the architecture may be symmetric on a client and a server, the specifications are asymmetric because of the different processing needs of a server and its client.
  • the generic architecture could be used to implement an encryption scheme, logging of messages, debugging of problems, and so on.
  • the protection system may intercept messages by instrumenting application programming interfaces ("APIs") to process the messages.
  • APIs application programming interfaces
  • the receive function of a sock layer API may be instrumented to invoke the underlying, non-instrumented receive function and then to pass a buffer containing the message to the protection component. If the protection component determines that the message will exploit a vulnerability, the protection may discard the message or tear down the communication session, and the instrumented receive function may return an error. Otherwise, the instrumented receive function may return the buffer as would the non-instrumented receive function.
  • the protection system may be used to intercept messages or portions of messages at various levels in a hierarchy of APIs.
  • a hierarchy of APIs includes APIs that invoke lower-level APIs, which in turn invoke still lower-level APIs.
  • a programmer of an application typically develops the application to invoke the highest level APIs.
  • an application may invoke a get order function of a customer relationship management system ("CRM") API to retrieve a new order from a customer.
  • the get order function may invoke a get header function and repeatedly invoke a get line item function of a lower-level ordering API to aggregate the order information for return to the application.
  • the get line item function may invoke the receive function of the socket layer API to retrieve the next line item message sent from the customer.
  • the get order function of the CRM API may be instrumented to pass the new order to the protection system.
  • the protection system may have handlers to analyze a new order parameter, and determine whether it would exploit a vulnerability.
  • the protection system may be used here to detect and correct the parameters that would exploit a vulnerability.
  • the protection system may be used to determine whether a new order from a customer can be authenticated. If not, the protection system can discard the new order and return an error to the application.
  • the protection system can be used to analyze the semantics of messages at various levels of abstraction.
  • FIG. 1 is a block diagram that illustrates the protection system in one embodiment.
  • the protection system 110 is connected to clients 130 via communications link 140 and to applications 120.
  • the protection system and the applications may execute on the same computer system, each on a different computer system, or some combination thereof.
  • the protection system includes a vulnerability specification store 111 and a protection component 112.
  • the vulnerability specification store contains a vulnerability specification for each application.
  • the protection component identifies the application to which the message is directed and the session within that application.
  • the protection component transitions the message state for that session based on the vulnerability specification for that application.
  • the messages that do not lead to exploits against a vulnerability are handed to the application directly.
  • the protection component in contrast, may drop messages that would exploit the vulnerability and take other appropriate action such as tearing down the session.
  • the vulnerability specification store may be loaded and unloaded dynamically with new specifications as new vulnerabilities are discovered without interrupting the operation of the protection system.
  • Figure 2 is a state diagram that illustrates a portion of a message protocol defined in a vulnerability specification in one embodiment.
  • States 211-215 represent message protocol states of an application relating to the vulnerability. These states are a subset of the message states of the application.
  • Handlers 221-224 represent sets of actions that are performed as the message state associated with a session transitions from state to state as messages are received.
  • State 211 is the initial state of a session and indicates that the session is waiting for an RPC bind message. When in state 211 and an RPC bind message is received, the protection system executes the RPC bind handler 221.
  • the RPC bind handler sets the next state of the session to state 212, which is waiting for an RPC bind acknowledgment, or to state 215, which is the final state of the session.
  • state 212 and an RPC bind acknowledgment message the protection system executes the RPC bind acknowledgment handler 222.
  • the RPC bind acknowledgment handler transitions to state 213, which waits for an RPC request, or to state 215, which is the final state.
  • the protection system executes the RPC request handler 223.
  • the RPC request handler determines that a vulnerability would be exposed based on the content of the message, then it sets the next state to state 214, which indicates to tear down the session, else it sets to state 215, which is the final state.
  • the protection system invokes the tear down session acknowledgment handler 224 to complete the tear down of the session and transitions to state 215, which is the final state.
  • Handlers 221 and 222 may allow the messages to be sent to the application, but handler 223 may not allow the message to be sent to the application when the next state is state 214.
  • FIG. 3 is a block diagram that illustrates the architecture of the protection system in one embodiment.
  • the protection system includes a policy loader 301, an application dispatcher 303, a session dispatcher 304, a state machine engine 305, and an interpreter 306.
  • the protection system also includes a vulnerability specification store 302 and an application/session state store 307.
  • the policy loader receives protection policies for vulnerabilities, converts protection policies to vulnerability specifications, and stores them in the vulnerability protection store.
  • the policy loader may automatically combine vulnerability specifications for the same application so that each application has only one vulnerability specification.
  • a message that is received by the protection system is first processed by the application dispatcher.
  • the application dispatcher identifies the port associated with the message from the message header and then requests the vulnerability specification store to identify the application associated with that port number.
  • the vulnerability specification store responds with the application identifier.
  • the application dispatcher then forwards the application identifier and the message to the session dispatcher.
  • the session dispatcher identifies the session associated with the message.
  • the session dispatcher requests the vulnerability store to provide session identification information associated with the application identifier.
  • the vulnerability specification store responds with the information describing the location of the session identifier within the message and may also provide the location of the message type and message boundary and other header or payload descriptive information.
  • the session dispatcher then uses the location information to retrieve the session identifier from the message.
  • the session dispatcher may also analyze the message to identify a message event associated with the message. In one embodiment, there may be a one-to-one correspondence between message types and events.
  • the state machine engine receives the application identifier, session identifier, current event, and message from the session dispatcher.
  • the state machine engine provides the application identifier to the vulnerability specification store and requests the state machine triplets associated with that application identifier.
  • the state machine engine also provides the application identifier and session identifier to the application/session state store and requests the associated state information.
  • the state machine engine searches for a triplet that matches the current state and the current event. When a match is found, the state machine engine directs the interpreter to execute the handler associated with the matching triplet.
  • the interpreter executes the handler, which performs the actions defined by the corresponding protection policy.
  • the actions may include storing state information such as the next state in the application/session state store.
  • the handlers may also retrieve information from the application/ session state store, for example, that was stored by a handler processing a previous message of the session.
  • the computing device on which the protection system is implemented may include a central processing unit, memory, input devices (e.g., keyboard and pointing devices), output devices (e.g., display devices), and storage devices (e.g., disk drives).
  • the memory and storage devices are computer-readable media that may contain instructions that implement the protection system.
  • data structures and message structures may be stored or transmitted via a data transmission medium, such as a signal on a communications link.
  • Various communications links may be used, such as the Internet, a local area network, a wide area network, or a point-to-point dial-up connection.
  • Figure 3 illustrates an example of a suitable operating environment in which the protection system may be implemented.
  • the operating environment is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality of the protection system.
  • Other well-known computing systems, environments, and configurations that may be suitable for use include personal computers, server computers, hand-held or laptop devices, routers, switches, multiprocessor systems, microprocessor-based systems, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
  • the protection system may be described in the general context of computer-executable instructions, such as program modules, executed by one or more computers or other devices.
  • program modules include routines, programs, objects, components, data structures, and so on that perform particular tasks or implement particular abstract data types.
  • functionality of the program modules may be combined or distributed as desired in various embodiments.
  • application refers to any type of executing software such as drivers, kernel-mode code, operating systems, system utilities, web servers, database servers, and so on.
  • Table 1 illustrates a portion of a protection policy in one embodiment.
  • the protection policy may be developed using a special-purpose language.
  • a protection policy has a first part with application and state machine information, and a second part with handlers and payload instructions.
  • the lines that start out with "#" are comments.
  • the application information (lines 1-5) describes location and port information.
  • the state machine information (lines 6-28) describes the states, events, and triplets.
  • the handlers (lines 46-67) define processing to be performed.
  • the payload instructions (lines 29-45) specify how to parse the field of a message of the application.
  • the payload instructions need only to define the field used in detecting an exploitation.
  • the other fields can be lumped together and skipped over during field parsing.
  • the handlers could theoretically be written in any programming language.
  • a language should be used that would make it difficult to attack the protection policies themselves.
  • a special-purpose programming language has been developed to help prevent such attacks.
  • the language uses data types of Boolean, counter (e.g., integer), and word and byte arrays.
  • the language also provides various operations such as drop a message, tear down a session, determine message length, and so on.
  • the operation ">>payload" (e.g., line 49) indicates to parse the payload (e.g., payload is "P_RPCRequest buffer size) according to the specified payload instructions.
  • the language may also allow statements such as if-then statements, special-purpose for-loops, and so on.
  • the special-purpose for-loops are used for iterative payload structures.
  • the handlers are interpreted at runtime by an interpreter.
  • SHIELD Name, Transport_Protocol, (port-list)
  • SHIELD Vehicleability_Behind_MSBlast, TCP, (135, 139, 445)
  • Figure 4 is a flow diagram that illustrates the processing of the state machine engine in one embodiment.
  • the engine is passed a current event, an application identifier, a session identifier, and a message.
  • the engine provides the application identifier and session identifier to the application/session state store.
  • the engine receives the current state for the application identifier and session identifier from the application/session state store.
  • the engine provides the application identifier to the vulnerability specification store.
  • the engine receives the state machine triplets for the application identifier from the vulnerability specification store.
  • the engine loops determining whether a triplet matches the current state and the current event.
  • the engine selects the next triplet.
  • the set of triplets may include a default triplet that identifies a handler to be executed if no other triplets match the current state and current event.
  • the state and event of a triplet may be regular expressions that define states and events that match the triplet.
  • decision block 407 if the state of the triplet matches the current state and the event of the triplet matches the current event, then the engine continues at block 408, else the engine loops to block 405 to select the next triplet.
  • the engine invokes the interpreter passing the handler, application identifier, session identifier, current event, and message. The engine then completes.
  • FIG. 5 is a block diagram that illustrates the testing of a vulnerability specification in one embodiment.
  • the protection system 510 includes the vulnerability specification 511 that is to be tested.
  • the protection system also includes protection component 512, which may correspond to the application dispatcher, the session dispatcher, the state machine engine, and the interpreter of Figure 3 .
  • the protection system provides messages to the application 501 whose vulnerability is represented by the vulnerability specification.
  • the network simulator 502 passes messages to the protection system.
  • the messages may be retrieved from network data 503 that has been collected from typical message sequences that are provided to the application or may be a synthetic test suite of representative traffic. Because the protection system is not a patch to the application, the testing is simplified. In particular, side effects associated with the protection system can be more easily isolated than those of a typical application.
  • the protection system either provides messages or drops messages. If the network data does not include a sequence of messages that exposes the vulnerability, then all messages should pass through the protection system and be provided to the application. If a message is discarded by the protection system, that may indicate a problem with the vulnerability specification or may indicate that an exposing of the vulnerability has been detected.
  • FIG. 6 is a block diagram that illustrates the generation of a vulnerability specification in one embodiment.
  • Vulnerability specifications may be generated automatically or semiautomatically based on a standard definition for the message protocol state machine for applications.
  • the specification generator 610 inputs a message protocol state machine description 601 for an application defined using the standard definition.
  • the specification generator processes the state machine and outputs the appropriate vulnerability specification 602.
  • the specification generator includes an identify vulnerability state machine component 611, a generate handler component 612, and a create specification component 613.
  • the identify vulnerability state machine component receives user input to identify the portion of the state machine that exposes the vulnerability.
  • the user input may select the states that lead to exposing the vulnerability and may provide various conditions for the states to indicate how and in what instances each state is considered to expose the vulnerability.
  • the generate handler component may automatically generate the handlers based on user input.
  • the create specification component generates the vulnerability specification or a protection policy from the vulnerability state machine and the handlers.
  • the protection system may request the application for a decryption key.
  • the protection system can then decrypt the message and process the decrypted message.
  • the protection system can provide the un-decrypted version of the message to the application.
  • the protection system may retrieve the decryption key from a key vault of the application.
  • a decryption key may also be provided to the protection system by a system administrator or key escrow system.
  • a vulnerability specification can be developed to detect such a port and register the port for that application with the vulnerability specification store.
  • the protection system has been described primarily in the context of message-based protocols, the principles of the protection system can also be applied to stream-based protocols. Also, the protection policies may use regular expressions in place of a finite state machine. The protection system may be used in conjunction with the techniques described in U.S. Provisional Patent Application No. 60/547,415 (Attorney Docket No. 41826.8018US), entitled “METHOD AND SYSTEM FOR DYNAMIC SYSTEM PROTECTION,” and filed on February 23, 2004 and published as US2005/188419 on 25 August 2005 .
  • protection policies can be automatically enabled or disabled depending on the patches that have been applied to an application.
  • the protection system can be used to detect attempted exploits of vulnerabilities based on invoking application programming interfaces ("APIs") of an application.
  • APIs application programming interfaces
  • An API provides an interface through which programs can access the services of the application.
  • the interface defines a communication protocol for a program to communicate with the application.
  • communication protocol refers to procedures and rules for communicating between components and is not limited to the protocols of the ISO protocol stack. Accordingly, the invention is not limited except by the appended claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)

Claims (20)

  1. Procédé exécuté dans un système informatique (110) pour identifier quand une condition de communication avec un composant (120) est satisfaite, le procédé comprenant :
    la fourniture d'une spécification qui spécifie au moins une portion d'un protocole de communication qui est implémenté par le composant et indique quand la condition est satisfaite dans la portion spécifiée du protocole de communication ;
    dans lequel la condition exposerait une vulnérabilité du composant (120), et dans lequel la spécification est indépendante de toute exploitation de la vulnérabilité ;
    la réception d'une communication pour le composant (120) ;
    avant que la communication reçue soit traitée par le composant (120), la détermination du fait que la communication reçue satisferait ou non à la condition comme spécifié par la spécification fournie ; et
    la modélisation du protocole de communication utilisé par le composant (120) de telle sorte que des conditions exposant des vulnérabilités sont détectées et évitées ;
    dans lequel le composant traite des sessions multiples et la détermination est basée uniquement sur des communications d'une session.
  2. Procédé selon la revendication 1 dans lequel, quand il est déterminé que la communication reçue satisferait à la condition, la communication reçue n'est pas fournie au composant.
  3. Procédé selon la revendication 2 dans lequel, quand il est déterminé que la communication reçue ne satisferait pas à la condition, la communication reçue est fournie au composant.
  4. Procédé selon la revendication 1 dans lequel la spécification fournie définit un automate fini pour contrôler le traitement de communications.
  5. Procédé selon la revendication 4 dans lequel l'automate fini définit des états du protocole de communication et des événements pour effectuer une transition entre états.
  6. Procédé selon la revendication 1 dans lequel la spécification fournie définit un automate fini pour contrôler le traitement de communications.
  7. Procédé selon la revendication 6 dans lequel l'automate fini définit des états du protocole de communication et des événements pour effectuer une transition entre états.
  8. Procédé selon la revendication 7 dans lequel la spécification spécifie une action à mettre en oeuvre lors d'une transition entre états.
  9. Procédé selon la revendication 8 dans lequel l'action consiste à supprimer la fourniture de la communication reçue au composant quand une vulnérabilité serait exposée.
  10. Procédé selon la revendication 8 dans lequel la détermination est mise en oeuvre par un moteur d'automate fini qui entre la spécification, un état actuel et un événement actuel, sélectionne un gestionnaire identifié dans la spécification pour l'état actuel et l'évènement actuel, et dirige l'exécution du gestionnaire pour mettre l'action en oeuvre.
  11. Procédé selon la revendication 6 dans lequel l'information d'état est stockée sur une base par composant.
  12. Procédé selon la revendication 6 dans lequel l'information d'état est stockée sur une base par session.
  13. Procédé selon la revendication 1 dans lequel les communications sont reçues d'une couche de transport.
  14. Procédé selon la revendication 1 dans lequel, quand une communication est mise en paquets, des paquets de la communication sont stockés sur une base par connecteur logiciel jusqu'à ce que tous les paquets de la communication soient reçus.
  15. Procédé selon la revendication 1 dans lequel, quand une communication est chiffrée, une clé de déchiffrement du composant est extraite et la communication est déchiffrée.
  16. Support lisible par un ordinateur contenant des instructions qui implémentent un système de protection pour contrôler un système informatique afin d'identifier quand une condition d'un protocole de messagerie d'une application doit être satisfaite, en mettant en oeuvre un procédé comprenant :
    la fourniture d'une spécification qui spécifie au moins une portion d'un protocole de messagerie et indique quand, dans la portion spécifiée du protocole de messagerie, la condition est satisfaite ;
    dans lequel la condition exposerait une vulnérabilité de l'application, et dans lequel la spécification est indépendante de toute exploitation de la vulnérabilité ;
    la réception d'un message pour l'application ;
    avant que le message reçu soit traité par l'application, la détermination du fait que le message reçu satisferait ou non à la condition comme spécifié par la spécification fournie ; et
    la modélisation du protocole de communication utilisé par l'application de telle sorte que des conditions exposant des vulnérabilités sont détectées et évitées ;
    dans lequel l'application traite des sessions multiples et la détermination est basée uniquement sur des communications d'une session.
  17. Support lisible par un ordinateur selon la revendication 16 dans lequel, quand il est déterminé que le message reçu satisferait à la condition, le message reçu n'est pas fourni à l'application.
  18. Support lisible par un ordinateur selon la revendication 17 dans lequel, quand il est déterminé que le message reçu ne satisferait pas à la condition, le message reçu est fourni à l'application.
  19. Support lisible par un ordinateur selon la revendication 16 dans lequel la spécification fournie définit un automate fini pour contrôler le traitement de messages.
  20. Support lisible par un ordinateur selon la revendication 19 dans lequel l'automate fini définit des états du protocole de messagerie et des événements pour effectuer une transition entre états.
EP05101123.7A 2004-02-24 2005-02-15 Méthode et dispositif de filtrage des communications pour prévenir l'exploitation de vulnérabilités logicielles Expired - Lifetime EP1569413B1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19175041.3A EP3544259A1 (fr) 2004-02-24 2005-02-15 Procédé et système de filtrage de communications pour prévenir l'exploitation d'une vulnérabilité logicielle

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US54713104P 2004-02-24 2004-02-24
US547131 2004-02-24
US955963 2004-09-30
US10/955,963 US7694022B2 (en) 2004-02-24 2004-09-30 Method and system for filtering communications to prevent exploitation of a software vulnerability

Related Child Applications (1)

Application Number Title Priority Date Filing Date
EP19175041.3A Division EP3544259A1 (fr) 2004-02-24 2005-02-15 Procédé et système de filtrage de communications pour prévenir l'exploitation d'une vulnérabilité logicielle

Publications (3)

Publication Number Publication Date
EP1569413A2 EP1569413A2 (fr) 2005-08-31
EP1569413A3 EP1569413A3 (fr) 2005-11-30
EP1569413B1 true EP1569413B1 (fr) 2019-06-12

Family

ID=34915591

Family Applications (2)

Application Number Title Priority Date Filing Date
EP19175041.3A Withdrawn EP3544259A1 (fr) 2004-02-24 2005-02-15 Procédé et système de filtrage de communications pour prévenir l'exploitation d'une vulnérabilité logicielle
EP05101123.7A Expired - Lifetime EP1569413B1 (fr) 2004-02-24 2005-02-15 Méthode et dispositif de filtrage des communications pour prévenir l'exploitation de vulnérabilités logicielles

Family Applications Before (1)

Application Number Title Priority Date Filing Date
EP19175041.3A Withdrawn EP3544259A1 (fr) 2004-02-24 2005-02-15 Procédé et système de filtrage de communications pour prévenir l'exploitation d'une vulnérabilité logicielle

Country Status (5)

Country Link
US (1) US7694022B2 (fr)
EP (2) EP3544259A1 (fr)
JP (1) JP4864333B2 (fr)
KR (1) KR101109393B1 (fr)
CN (1) CN1728706B (fr)

Families Citing this family (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7584382B2 (en) * 2004-02-19 2009-09-01 Microsoft Corporation Method and system for troubleshooting a misconfiguration of a computer system based on configurations of other computer systems
US7392295B2 (en) * 2004-02-19 2008-06-24 Microsoft Corporation Method and system for collecting information from computer systems based on a trusted relationship
US8023408B2 (en) * 2004-11-19 2011-09-20 International Business Machines Corporation Dynamically changing message priority or message sequence number
US20100195538A1 (en) * 2009-02-04 2010-08-05 Merkey Jeffrey V Method and apparatus for network packet capture distributed storage system
US7343599B2 (en) * 2005-01-03 2008-03-11 Blue Lane Technologies Inc. Network-based patching machine
US7584182B2 (en) * 2005-12-19 2009-09-01 Microsoft Corporation Determining cardinality of a parameter using hash values
US7743123B2 (en) * 2005-12-19 2010-06-22 Microsoft Corporation Aggregating information from a cluster of peers
US7856100B2 (en) * 2005-12-19 2010-12-21 Microsoft Corporation Privacy-preserving data aggregation using homomorphic encryption
US8510596B1 (en) 2006-02-09 2013-08-13 Virsec Systems, Inc. System and methods for run time detection and correction of memory corruption
US7599861B2 (en) 2006-03-02 2009-10-06 Convergys Customer Management Group, Inc. System and method for closed loop decisionmaking in an automated care system
US8379830B1 (en) 2006-05-22 2013-02-19 Convergys Customer Management Delaware Llc System and method for automated customer service with contingent live interaction
US7809663B1 (en) 2006-05-22 2010-10-05 Convergys Cmg Utah, Inc. System and method for supporting the utilization of machine language
US8234706B2 (en) * 2006-09-08 2012-07-31 Microsoft Corporation Enabling access to aggregated software security information
US9147271B2 (en) 2006-09-08 2015-09-29 Microsoft Technology Licensing, Llc Graphical representation of aggregated data
US8266702B2 (en) * 2006-10-31 2012-09-11 Microsoft Corporation Analyzing access control configurations
US8302197B2 (en) 2007-06-28 2012-10-30 Microsoft Corporation Identifying data associated with security issue attributes
US8250651B2 (en) * 2007-06-28 2012-08-21 Microsoft Corporation Identifying attributes of aggregated data
US8289854B1 (en) * 2007-11-28 2012-10-16 Mcafee, Inc. System, method, and computer program product for analyzing a protocol utilizing a state machine based on a token determined utilizing another state machine
US8625642B2 (en) * 2008-05-23 2014-01-07 Solera Networks, Inc. Method and apparatus of network artifact indentification and extraction
US8004998B2 (en) * 2008-05-23 2011-08-23 Solera Networks, Inc. Capture and regeneration of a network data using a virtual software switch
US20090292736A1 (en) * 2008-05-23 2009-11-26 Matthew Scott Wood On demand network activity reporting through a dynamic file system and method
US8521732B2 (en) 2008-05-23 2013-08-27 Solera Networks, Inc. Presentation of an extracted artifact based on an indexing technique
US9262357B2 (en) 2008-09-29 2016-02-16 International Business Machines Corporation Associating process priority with I/O queuing
US8146158B2 (en) * 2008-12-30 2012-03-27 Microsoft Corporation Extensible activation exploit scanner
US8954725B2 (en) * 2009-05-08 2015-02-10 Microsoft Technology Licensing, Llc Sanitization of packets
WO2011060377A1 (fr) * 2009-11-15 2011-05-19 Solera Networks, Inc. Procédé et appareil permettant en temps réel une identification et un enregistrement des artefacts
WO2011060368A1 (fr) * 2009-11-15 2011-05-19 Solera Networks, Inc. Procédé et appareil permettant d'enregistrer et d'indexer des données de trafic de réseau haute vitesse
US8849991B2 (en) 2010-12-15 2014-09-30 Blue Coat Systems, Inc. System and method for hypertext transfer protocol layered reconstruction
US8666985B2 (en) 2011-03-16 2014-03-04 Solera Networks, Inc. Hardware accelerated application-based pattern matching for real time classification and recording of network traffic
AU2014318585B2 (en) * 2013-09-12 2018-01-04 Virsec Systems, Inc. Automated runtime detection of malware
AU2015279920B2 (en) 2014-06-24 2018-03-29 Virsec Systems, Inc. Automated root cause analysis of single or N-TIERED applications
CN106687981B (zh) 2014-06-24 2020-09-01 弗塞克系统公司 用于自动化检测输入和输出验证和资源管理漏洞的系统和方法
CN104484608A (zh) * 2014-12-16 2015-04-01 北京奇虎科技有限公司 一种应用程序的消息处理方法和装置
RU2606883C2 (ru) * 2015-03-31 2017-01-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ открытия файлов, созданных уязвимыми приложениями
JP6949951B2 (ja) 2016-06-16 2021-10-13 ヴァーセック システムズ，インコーポレイテッド コンピュータアプリケーション内のメモリ破損を修復するためのシステム及び方法
WO2018081833A1 (fr) * 2016-10-31 2018-05-03 Talla, Inc. Procédés et appareil pour machines à états exécutant des communications en langage naturel, et agents à ia surveillant l'état et déclenchant des transitions
US10534915B2 (en) * 2017-06-29 2020-01-14 Aqua Security Software, Ltd. System for virtual patching security vulnerabilities in software containers
US11579985B2 (en) * 2019-05-31 2023-02-14 Acronis International Gmbh System and method of preventing malware reoccurrence when restoring a computing device using a backup image

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL151455A0 (en) 2000-03-03 2003-04-10 Sanctum Ltd System for determining web application vulnerabilities
AU2001293080A1 (en) 2000-09-28 2002-04-15 Symantec Corporation System and method for analyzing protocol streams for a security-related event
JP3692290B2 (ja) * 2000-11-24 2005-09-07 株式会社エヌ・ティ・ティ・ドコモ データ取得方法および端末
EP1225513A1 (fr) * 2001-01-19 2002-07-24 Eyal Dotan Méthode de protection des logiciels et des données informatiques d'un logiciel hostile
US7313822B2 (en) * 2001-03-16 2007-12-25 Protegrity Corporation Application-layer security method and system
US7624444B2 (en) * 2001-06-13 2009-11-24 Mcafee, Inc. Method and apparatus for detecting intrusions on a computer system
US7359962B2 (en) 2002-04-30 2008-04-15 3Com Corporation Network security system integration
US7454499B2 (en) * 2002-11-07 2008-11-18 Tippingpoint Technologies, Inc. Active network defense system and method
JP3999188B2 (ja) * 2003-10-28 2007-10-31 富士通株式会社 不正アクセス検知装置、不正アクセス検知方法および不正アクセス検知プログラム

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
JP4864333B2 (ja) 2012-02-01
CN1728706B (zh) 2010-06-16
CN1728706A (zh) 2006-02-01
US7694022B2 (en) 2010-04-06
EP1569413A2 (fr) 2005-08-31
KR101109393B1 (ko) 2012-01-30
JP2005276185A (ja) 2005-10-06
EP3544259A1 (fr) 2019-09-25
EP1569413A3 (fr) 2005-11-30
KR20060042149A (ko) 2006-05-12
US20050198110A1 (en) 2005-09-08

Similar Documents

Publication Publication Date Title
EP1569413B1 (fr) Méthode et dispositif de filtrage des communications pour prévenir l'exploitation de vulnérabilités logicielles
AU2017285429B2 (en) Systems and methods for remediating memory corruption in a computer application
CN1777179B (zh) 用于分发安全策略的方法和系统
US7430760B2 (en) Security-related programming interface
KR102368170B1 (ko) 멀웨어의 자동화된 런타임 검출
US8769127B2 (en) Cross-domain solution (CDS) collaborate-access-browse (CAB) and assured file transfer (AFT)
US11227032B1 (en) Dynamic posture assessment to mitigate reverse engineering
Yu et al. Trustworthy web services based on testing
Araujo et al. Embedded honeypotting
Endsuleit et al. A security analysis on jade (-s) v. 3.2
Corrick Progger 3: A low-overhead, tamper-proof provenance system
Ahonen Transparent Quantum Safe Tunneling
Lei Building Infrastructure Support for Organizational Security: An Approach to Network
CN119094189A (zh) 一种内生安全云密码服务管理系统及方法
CN120498854A (zh) 用于容器化集群的出口流量加密方法及装置、存储介质、计算机设备
Alkhayaat et al. Protection Against Internal Intruding using Host Identifier Authentication
Murphy Counterintelligence through malicious code analysis
McGann Adaptive virtual protocol stacks for intrusion detection applications

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR LV MK YU

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR LV MK YU

17P Request for examination filed

Effective date: 20060328

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

17Q First examination report despatched

Effective date: 20070207

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20190116

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1144041

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190615

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602005055900

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: NL

Ref legal event code: FP

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190913

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190912

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1144041

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190612

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191014

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191012

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602005055900

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: NL

Payment date: 20200212

Year of fee payment: 16

26N No opposition filed

Effective date: 20200313

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200224

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PG2D Information on lapse in contracting state deleted

Ref country code: IS

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191112

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20200229

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200215

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200229

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200229

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200215

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200229

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20210112

Year of fee payment: 17

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20210202

Year of fee payment: 17

Ref country code: GB

Payment date: 20210203

Year of fee payment: 17

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602005055900

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

REG Reference to a national code

Ref country code: NL

Ref legal event code: MM

Effective date: 20210301

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210301

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190612

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602005055900

Country of ref document: DE

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20220215

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220215

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220901

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230505